VYPR
← All advisories
High severity7.1NVD Advisory· Published Aug 11, 2026· Updated Sep 16, 2026

CVE-2026-18687

CVE-2026-18687

Description

MongoDB Server's handling of a Queryable Encryption maintenance operation did not properly validate certain request parameters against the collection's encrypted field configuration before use. An authenticated user with readWrite privileges could submit a specially formed request that leads to a server crash or excessive internal writes, resulting in resource exhaustion and corruption of encrypted index data.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • MongoDB/MongoDB4 versions
    cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*range: >=8.0.0,<8.0.29
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha0:*:*:-:-:*:*
    • cpe:2.3:a:mongodb:mongodb:9.0.0:alpha1:*:*:-:-:*:*
    • cpe:2.3:a:mongodb:mongodb:9.1.0:alpha0:*:*:-:-:*:*
  • osv-coords
    pkg:bitnami/mongodb
    Range: >= 8.0.0, < 8.0.29
  • MongoDB/Serverllm-fuzzy

Patches

Vulnerability mechanics

References

1

News mentions

1